Systems and Methods for Controlling Data Exposure Using Artificial-Intelligence-Based Periodic Modeling

ABSTRACT

Systems and methods for periodically modifying data privacy elements are provided. The systems and methods may identify a set of data privacy elements. A data privacy element can characterizes a feature of a computing device and can be detectable by a network host. A first artificial profile can be generated by modifying a first data privacy element based on an artificial profile model that defines a relationship associated with one or more constraints between the set of data privacy elements. Subsequent to generating the first artificial profile, a second artificial profile can be generated by periodically modifying a second data privacy element in accordance with the relationship defined by the artificial profile model. The computer device can be masked from being identified by the network host by sending the second artificial profile including the second data privacy element to a requested network location.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation and claims the prioritybenefit of U.S. application Ser. No. 16/657,598, filed Oct. 18, 2019,which is a continuation in part and claims the priority benefit of U.S.application Ser. No. 16/280,755, filed Feb. 20, 2019 and granted as U.S.Pat. No. 10,706,158 on Jul. 7, 2020, which is a continuation of andclaims the priority benefit of U.S. application Ser. No. 16/005,268,filed Jun. 11, 2018 and granted as U.S. Pat. No. 10,282,553 on May 7,2019, the disclosure of which is incorporated herein by reference. Thepresent application is related to PCT Patent Application No.PCT/US2019/14143, filed Jan. 18, 2019, which is a continuation of andclaims the priority benefit of U.S. application Ser. No. 16/005,268,filed Jun. 11, 2018 and granted as U.S. Pat. No. 10,282,553 on May 7,2019, and is also related to U.S. application Ser. No. 16/273,877, filedFeb. 12, 2019, which is a continuation in part and claims the prioritybenefit of U.S. application Ser. No. 16/005,268, filed Jun. 11, 2018 andgranted as U.S. Pat. No. 10,282,553 on May 7, 2019. The presentapplication is related to PCT Patent Application No. PCT/US2020/18981,filed Feb. 20, 2020 which claims priority to Ser. No. 16/280,755 filedFeb. 20, 2019 and granted as U.S. Pat. No. 10,706,158 on Jul. 7, 2020.

TECHNICAL FIELD

The present disclosure relates to systems and methods for controllingdata exposed to external networks using artificial-intelligence-basedmodeling. More particularly, the present disclosure relates to systemsand methods for dynamically creating, modifying, and validatingartificial profiles using a data protection platform to control dataexposure.

BACKGROUND

Every computing device connected to the Internet produces exposabledata. The exposable data may be accessed by authorized network hosts(e.g., web servers providing access to a webpage) or unauthorizednetwork hosts (e.g., hackers) through a network. In some scenarios, theexposed data can be used to reveal sensitive information relating todevices or the users operating the devices. For instance, when a laptopconnects to a web server to gain access to a webpage, the web server canquery the browser for certain information. However, an unauthorizednetwork host could exploit a vulnerability in a network using thatinformation. For example, the unauthorized network host can execute adata breach of a network using the obtained information. Thenear-constant usage of computing devices and the Internet increases thecomplexity of and privacy risks associated with exposable data.

SUMMARY

The term embodiment and like terms are intended to refer broadly to allof the subject matter of this disclosure and the claims below.Statements containing these terms should be understood not to limit thesubject matter described herein or to limit the meaning or scope of theclaims below. Embodiments of the present disclosure covered herein aredefined by the claims below, not this summary. This summary is ahigh-level overview of various aspects of the disclosure and introducessome of the concepts that are further described in the DetailedDescription section below. This summary is not intended to identify keyor essential features of the claimed subject matter, nor is it intendedto be used in isolation to determine the scope of the claimed subjectmatter. The subject matter should be understood by reference toappropriate portions of the entire specification of this disclosure, anyor all drawings and each claim.

Embodiments of the present disclosure include a computer-implementedmethod. In some embodiments, the method may include identifying a set ofdata privacy elements and generating an artificial profile model. Forexample, a data privacy element may characterize a feature of acomputing device. A data privacy element may be detectable by anunauthorized network host (e.g., a hacker or a virus) or an authorizednetwork host (e.g., an authorized website or web server). Further, theartificial profile model may include the set of data privacy elements.The artificial profile model may include a constraint for generating newartificial profiles. The method may also include receiving a signalindicating that a computing device is requesting access to a networklocation; and detecting one or more data privacy elements associatedwith the computing device request to access the network location. Themethod may include determining an artificial profile for the computingdevice. The artificial profile may include the one or more data privacyelements. The artificial profile may be usable to identify the computingdevice. The method may include automatically modifying the one or moredata privacy elements. For example, modifying the one or more dataprivacy elements may use the constraint included in the artificialprofile model. The method may include generating a new artificialprofile for the computing device. The new artificial profile may includethe modified one or more data privacy elements. The new artificialprofile may mask the computing device from being identified.

Embodiments of the present disclosure include a system. The system maycomprise: one or more data processors; and a non-transitorycomputer-readable storage medium containing instructions which, whenexecuted on the one or more data processors, cause the one or more dataprocessors to perform operations including the methods described aboveand herein.

Embodiments of the present disclosure include a computer-program producttangibly embodied in a non-transitory machine-readable storage medium,including instructions configured to cause a data processing apparatusto perform operations including the methods described above and herein.

BRIEF DESCRIPTION OF THE DRAWINGS

The specification makes reference to the following appended figures, inwhich use of like reference numerals in different figures is intended toillustrate like or analogous components.

FIG. 1 is a schematic diagram illustrating a network environment inwhich exposable data can be accessed by authorized or unauthorizednetwork hosts, according to certain aspects of the present disclosure.

FIG. 2 is a schematic diagram illustrating a network environment inwhich exposable data associated with computing devices can be accessedby authorized or unauthorized network hosts, according to certainaspects of the present disclosure.

FIG. 3 is a schematic diagram illustrating a network environment inwhich exposable data can be accessed by authorized or unauthorizednetwork hosts at various stages of an interaction session, according tocertain aspects of the present disclosure.

FIG. 4 is a schematic diagram illustrating the network environment ofFIG. 3 with the addition of a data protection platform that blocks,modifies, or observes exposable data, according to certain aspects ofthe present disclosure.

FIG. 5 is a schematic diagram illustrating a data protection platform,according to certain aspects of the present disclosure.

FIG. 6 is a block diagram illustrating a non-exhaustive set of dataprivacy elements that can be exposed to network hosts.

FIG. 7 is a block diagram illustrating an artificial profile model,according to certain aspects of the present disclosure.

FIGS. 8A-8C are block diagrams illustrating artificial profilesgenerated using the artificial profile model illustrated in FIG. 7,according to certain aspects of the present disclosure.

FIG. 9A is a schematic diagram illustrating artificial profiles thatchange over time using the artificial profile models illustrated in FIG.8C, according to certain aspects of the present disclosure;

FIG. 9B is a schematic diagram illustrating artificial profilesgenerated using data profile seeding techniques, according to certainaspects of the present disclosure;

FIG. 10 is a schematic diagram illustrating artificial profilesgenerated using deception techniques, according to certain aspects ofthe present disclosure;

FIG. 11 is a diagram illustrating a process flow for controlling inputsignatures during an interaction session, according to certain aspectsof the present disclosure.

In the appended figures, similar components and/or features can have thesame reference label. Further, various components of the same type canbe distinguished by following the reference label by a dash and a secondlabel that distinguishes among the similar components. If only the firstreference label is used in the specification, the description isapplicable to any one of the similar components having the same firstreference label irrespective of the second reference label.

DETAILED DESCRIPTION

Certain aspects and features of the present disclosure relate to systemsand methods for controlling data exposure usingartificial-intelligence-based (hereinafter referred to as “AI-based”)profile models. Specifically, certain aspects and features of thepresent disclosure relate to systems and methods for providing a dataprotection platform that is configured to automatically manage theexposure of data privacy elements. For example, a data privacy elementmay be any item of data that can be exposed (e.g., accessible) to athird-party, such as a hacker. Data privacy elements can be evaluated(e.g., alone or in combination with other data, such as social mediaprofiles) to expose information about users and/or or network systems(e.g., organizations). Non-limiting examples of data privacy elementsinclude activity data (e.g., web browsing history), network data (e.g.,network topology), application data (e.g., applications downloaded onthe computing device), operating system data (e.g., the operating system(OS) and the corresponding version of the OS running on the computingdevice), hardware data (e.g., the specific hardware components thatcomprise the computing device), and other suitable data that exposesinformation about a user and/or a network.

When a computing device accesses the Internet, various data privacyelements may be exposed as the computing device navigates across webservers. For example, when the computing device accesses an InternetService Provider (ISP), certain data privacy elements may be stored atthe ISP's servers as the ISP facilitates an Internet connection.However, the data privacy elements that are stored at the ISP's serversmay be accessible to other network hosts, such as authorized users(e.g., network security engineers) or unauthorized users (e.g.,hackers). The accessibility of the stored data privacy elements by otherusers exposes the data privacy elements. This data exposure creates asecurity risk because the data privacy elements can be used byunauthorized users, for example, to identify vulnerabilities of thecomputing device or of the network systems to which the computing deviceis connected. Identifying vulnerabilities leaves the computing device orthe network to which the computing device is connected open to databreaches or other nefarious conduct.

According to certain embodiments, the data protection platform canenhance data protection by controlling and/or managing the exposure ofthe data privacy elements. In some implementations, the data protectionplatform (described in greater detail at FIG. 5) may include anapplication that is deployed in a cloud network environment. Forexample, the data protection platform may include an application serveron which an application is stored, which, when executed, performsvarious operations defined by the data protection platform. The dataprotection platform may also include one or more database servers onwhich the storage functionalities associated with the application can beperformed in the cloud network environment. In some implementations, thecomputing device (e.g., operating by a user) can connect to the dataprotection platform using a platform-secured browser. For example, theplatform-secured browser can be hosted by the data protection platformto avoid the Internet activity performed on the computing device beingstored locally at the computing device. According to certainembodiments, while the computing device navigates the Internet using theplatform-secured browser, the data protection platform canautomatically, dynamically, in real-time, and/or intelligently controlthe exposure of data privacy elements associated with the computingdevice or the network to which the computing device is connected.Non-limiting examples of controlling the exposure of data privacyelements can include blocking data privacy elements from beingaccessible by web servers or application servers, blocking data privacyelements from being stored at web servers or application servers,modifying one or more data privacy elements according to an artificialprofile model, providing the data privacy elements to web servers orapplications servers, detecting which data privacy elements are exposed,determining which data privacy elements are required to enable Internetactivity (e.g., certain websites do not function if cookies aredisabled), determining which data privacy elements are not required toenable Internet activity, modifying a feature (e.g., a time signature ofkeystrokes, taps, or mouse clicks) of input received from the computingdevice, or other suitable techniques for controlling exposure of dataprivacy elements. In some implementations, artificial profiles can bespecific to certain organizations, industries, subject matter, oruser-defined applications. For example, the artificial profiles specificto an organization would include data privacy elements that are relevantor consistent with data privacy elements that would be expected for theorganization.

Advantageously, the data protection platform can control the exposure ofdata privacy elements to protect the privacy of the user, computingdevice, and/or network systems (e.g., operated by organizations,companies, governments, or other suitable entities) as the computingdevice navigates the Internet. For instance, if a network host cancollect data privacy elements of users, computing devices, and/ornetworks (e.g., such that the collection is authorized or unauthorized),the collected data can expose information (e.g., potentially private orsensitive information) about the organization to which the users,computing devices, and/or networks belong. Thus, by using embodimentsdescribed herein for managing or controlling the exposure of dataprivacy elements for users, computing devices, and/or network systems ofan organization, the data protection platform thereby manages orcontrols the exposure of potentially sensitive information about theorganization itself. Managing or controlling the exposure of dataprivacy elements can prevent data breaches of the users, computingdevices, and/or network systems because network hosts, such as hackers,can be prevented from collecting certain data privacy elements, or canat least be prevented from collecting accurate data privacy elements,which obfuscate or mask identifies or attributes of the users, computingdevices, and/or network systems.

Further, the data protection platform can control the exposure of dataprivacy elements using artificial profiles, which are generated using anartificial profile model, to obfuscate the user and/or network in arealistic manner. In some implementations, the artificial profile model(described in greater detail with respect to FIG. 7) can include a modelthat is generated using machine-learning techniques and/or AItechniques. For example, the artificial profile model may include datarepresenting a relationship between two or more data privacy elements.The relationship between the two or more data privacy elements can beautomatically learned using machine-learning techniques, for example, orcan be user defined based one or more user-defined rules. In someimplementations, when the data protection platform modifies a dataprivacy element to obfuscate a computing device, the modification of thedata privacy element can be performed within the constraints of therelationship learned or defined by the artificial profile model.

As a non-limiting example, a specific application may be downloaded on acomputing device. Downloading the specific application on the computingdevice may also cause a specific set of fonts to be installed on thecomputing device. When the computing device accesses a website, the webserver that provides access to the website may execute a tracking asset(e.g., a cookie) that is stored in the computing device's browser. Thetracking asset can request certain data privacy elements from thecomputing device. For example, the tracking asset may request (from thecomputing device's browser) data privacy elements identifying whichfonts are installed on the computing device. From the perspective of thenetwork host (e.g., the web server providing access to the website), ifthe data privacy elements collected from the computing device indicatethat a font is installed on the computing device, or the lack of a fontinstalled on the computing device, that indication may be evaluated todetermine (with some likelihood) whether or not an application has beendownloaded onto the computing device. Again, from the perspective of thenetwork host, if the exposure of data privacy elements from thecomputing device indicate with a certain likelihood that an applicationhas been downloaded on the computing device, this information introducesan attack vector (e.g., known or unknown vulnerabilities or exploitsassociated with that application), exposes user information (e.g., theapplication is specific to an industry, which exposes the industryassociated with the organization), or may not provide any information atall.

According to certain embodiments, the data protection platform canobfuscate the identifiable attributes of the computing device bymodifying the data privacy elements (i.e., the identity of the fontsthat are installed on the computing device) so that the web servercollects inaccurate data about the computing device when the computingdevice accesses the website. However, the modification of the dataprivacy elements would not appear to be realistic (e.g., to a hacker) ifthe identity of the fonts were modified to include a font that wasinconsistent with the specific set of fonts associated with the specificapplication. Accordingly, in order to control the data privacy elementsof the computing device in a realistic manner, the artificial profilemodel can include data representing the relationship between thespecific application and the set of specific fonts. Thus, generating anartificial profile for the computing device may involve changing thespecific application to a new application, which is exposed to thewebsite, and to also modify the set of specific fonts to a set of newfonts associated with the new application. In this non-limiting example,the modified data privacy elements collected by the website (i.e., theidentity of the new application and the set of new fonts) will seemrealistic to a hacker because both data privacy elements (e.g., theapplication and the associated set of fonts) are consistent with eachother. As an advantage of the disclosed embodiments, generatingartificial profiles to be consistent with dependencies defined in theartificial profile model increases the realistic nature of the modifiedartificial profiles so as to enhance the data protection of computingdevices and/or networks.

These non-limiting and illustrative examples are given to introduce thereader to the general subject matter discussed here and are not intendedto limit the scope of the disclosed concepts. For example, it will beappreciated that data privacy elements other than fonts can becollected, including, but not limited to, which plugins are installed inthe browser of the computing device, or any other informationcollectable from a browser, computing device, or Operating Systemrunning on the computing device. The following sections describe variousadditional features and examples with reference to the drawings in whichlike numerals indicate like elements, and directional descriptions areused to describe the illustrative embodiments but, like the illustrativeembodiments, should not be used to limit the present disclosure. Theelements included in the illustrations herein may not be drawn to scale.

FIG. 1 is a schematic diagram illustrating network environment 100, inwhich exposable data can be accessed by authorized or unauthorizednetwork hosts, according to certain aspects of the present disclosure.Network environment 100 can include Internet 110, site network 120 andhome network 130. Each of Internet 110, site network 120, and homenetwork 130 can include any open network, such as the Internet, personalarea network, local area network (LAN), campus area network (CAN),metropolitan area network (MAN), wide area network (WAN), wireless localarea network (WLAN); and/or a private network, such as an intranet,extranet, or other backbone. In some instances, Internet 110, sitenetwork 120, and/or home network 130 can include a short-rangecommunication channel, such as Bluetooth or Bluetooth Low Energychannel. Communicating using a short-range communication such as BLEchannel can provide advantages such as consuming less power, being ableto communicate across moderate distances, being able to detect levels ofproximity, achieving high-level security based on encryption and shortranges, and not requiring pairing for inter-device communications.

In some implementations, communications between two or more systemsand/or devices can be achieved by a secure communications protocol, suchas secure sockets layer (SSL), transport layer security (TLS). Inaddition, data and/or transactional details may be encrypted based onany convenient, known, or to be developed manner, such as, but notlimited to, DES, Triple DES, RSA, Blowfish, Advanced Encryption Standard(AES), CAST-128, CAST-256, Decorrelated Fast Cipher (DFC), TinyEncryption Algorithm (TEA), eXtended TEA (XTEA), Corrected Block TEA(XXTEA), and/or RC5, etc.

As illustrated in the example of FIG. 1, site network 120 may beconnected to computer 160, home network 130 may be connected to mobiledevice 170 (e.g., a smartphone) and smart TV 180 (e.g., a televisionwith Internet capabilities), and Internet 110 may be connected to secureserver 140. Site network 120 may be a network that is operated by or foran organization, such as a business. Computer 160 may connect to secureserver 140 using site network 120. Home network 130 may be a networkthat is operated by or for a residential area, such as a single familydwelling or an apartment complex. Mobile device 170 and smart TV 180 mayconnect to secure server 140 using home network 130. Secure server 140may be any server connected to the Internet or a cloud networkenvironment. For example, secure server 140 may be a web server that ishosting a website. It will be appreciated that, while networkenvironment 100 shows a single site network and a single home network,any number of network in any configuration can be included in networkenvironment 100.

In some implementations, network host 150 may a computing device (e.g.,a computer) connected to a computer network, such as any of Internet110, site network 120, and/or home network 130. In some implementations,network host 150 may be any network entity, such as a user, a device, acomponent of a device, or any other suitable network device. In someinstances, network host 150 may be an authorized device, such as a webserver that allows users to access a website, an application server thatallows users to access an application, a network security engineer, orother suitable authorized devices. In some instances, network host 150may be an unauthorized network host, such as a hacker, a computer virus,or other malicious code. For example, network host 150 may be able toaccess secure server 140, site network 120, and/or home network 130 tocollect exposable data privacy elements that expose information aboutsecure server 140, site network 120, computer 160, home network 130,mobile device 170, and/or smart TV 180. As computer 160, mobile device170, and/or smart TV 180 communicate over Internet 110, for example,with secure server 140, various exposable data privacy elements can becollected and stored at servers or databases of any of site network 120,home network 130, or Internet 110. Either substantially in real-time(with Internet activity of computer 160, mobile device 170, or smart TV180) or non-real-time, network host 150 can access the data privacyelements that may be stored at secure server 140, site network 120,and/or home network 130. Network host 150 can access the stored dataprivacy elements in an authorized manner (e.g., a website that allowedaccess after a cookie has been installed in a browser) or anunauthorized manner (e.g., secure server 140 may be hacked by networkhost 150). Either way, network host 150 can evaluate the collected dataprivacy elements to determine whether there are any vulnerabilities inany aspects of secure server 140, site network 120, and/or home network130. Network host 150 can then use the vulnerabilities to execute a databreach. The ability of network host 150 to collect exposable dataprivacy elements is described in greater detail with respect to FIG. 2.Further, according to certain embodiments described herein, the dataprotection platform can be used to prevent network host 150 fromaccessing or collecting the data privacy elements or to obfuscate thereal data privacy elements so as to provide inaccurate or uselessinformation to network host 150.

FIG. 2 is a schematic diagram illustrating network environment 200, inwhich exposable data associated with computing devices can be accessedby authorized or unauthorized network hosts, according to certainaspects of the present disclosure. In some implementations, networkenvironment 200 can include secure server 1230, network 210, gateway220, mobile device 250, smart TV 260, and laptop 270. For example,network environment 200 may be similar to or a more detailed example ofhome network 130 of FIG. 1. Mobile device 250, smart TV 260, and laptop270 may be located within a defined proximity, such as within a home orresidence. Secure server 230 may be the same as or similar to secureserver 140, and thus, further description is omitted here for the sakeof brevity. Network 210 may be the same as site network 120 or homenetwork 130 of FIG. 1, and thus, further description is omitted here forthe sake of brevity. Network host 240 may be the same or similar tonetwork host 150, and thus, further description is omitted here for thesake of brevity. Gateway 220 may be an access point (e.g., a router)that enables devices, such as mobile device 250, smart TV 260, andlaptop 270 to connect to the Internet. FIG. 2 is provided to illustratehow network host 240 can collect exposable data privacy elements fromsecure server 230 based on routine and seemingly innocuous datacommunications between devices.

As a non-limiting example, smart TV 260 may be configured toautomatically and periodically transmit a signal to secure server 230.The signal may correspond to a request for updates to the softwarestored on smart TV 260. In this non-limiting example, secure server 230may be a server that stores software updates or that controls thedistribution of software updates to smart TVs like smart TV 260.However, the signal transmitted from smart TV 260 may include dataprivacy elements that expose information about smart TV 260, gateway220, and/or network 210. For example, the signal may include a varietyof data privacy elements, including, but not limited to, the version ofthe software currently stored on smart TV 260, the viewing datacollected by smart TV 260 (if authorized by the user), the service setidentifier (SSID) of gateway 220, a password to connect to gateway 220,login credentials associated with a user profile recently logged into onsmart TV 260, information about the hardware or firmware installed insmart TV 260, information about the hardware, firmware, or softwarerecognized to be installed at gateway 220, the physical location ofsmart TV 260 (e.g., determined using an Internet Protocol (IP) address),applications downloaded by a user on smart TV 260, and/or applicationusage data. The data privacy elements included in the signal may bestored at secure server 230.

In some cases, if relatively sensitive information is included in thesignal, such as viewing data (e.g., accessed video content) recentlycollected by smart TV 260, secure server 230 may store that sensitiveinformation securely behind protection mechanisms, such as firewalls.However, secure server 230 may be hacked by network host 240. In thisscenario, the sensitive information (i.e., the data privacy elementsincluded in the signal and subsequently stored at secure server 230) maybe exposed to network host 240.

In some cases, if relatively innocuous information is included in thesignal, such as the version of software stored on smart TV 260 or theSSID of gateway 220, the information may be stored at secure server 230without many protection mechanisms, such as firewalls. For instance,secure server 230 may not need to securely store the version of thesoftware currently stored on smart TV 260 because this information maybe relatively innocuous. However, network host 240 can access secureserver 230, either in an authorized or unauthorized manner, to obtainthe exposed data privacy element of the software version. The softwareversion can nonetheless be used maliciously by bad actors because thesoftware version can be exploited to identify vulnerabilities in thesoftware. The identified vulnerabilities can be used to execute a databreach or hacking of smart TV 260, which places at risk the privacyinformation associated with a user of smart TV 260.

FIG. 2 illustrates the problem of data privacy elements being exposableto other hosts, such as servers, hackers, websites, or authorized users,during an interaction between devices, such as smart TV 260 and secureserver 230. Exposable data privacy elements can be exploited byunauthorized hosts, such as hackers, to determine vulnerabilities thatcan be exploited to attack a network or an individual device. Further,exposable data privacy elements can also be exploited by authorizedhosts, such as a website, to profile users based on online activity;however, this profiling can create risks of private information beingexposed.

FIG. 3 is a schematic diagram illustrating network environment 300, inwhich exposable data can be accessed by authorized network hosts (e.g.,a web server hosting a webpage, an application server hosting anapplication, and so on) or unauthorized network hosts (e.g., a hacker)at various stages of a browsing session. Further, FIG. 4 is a schematicdiagram illustrating network environment 400, which is similar tonetwork environment 300, but with the addition of an exemplary dataprotection platform 440 that controls the exposure of data privacyelements to block or obfuscate private information from being exposed,according to certain embodiments.

Referring again to FIG. 3, network environment 300 can include laptop310, gateway 320, ISP 330, network 340, and secure server 350. A browsercan be running on laptop 310. The browser can enable a user operatinglaptop 310 to communicate with secure server 350 through network 340.However, as the browser running on laptop 310 interacts with secureserver 350, exposable data privacy elements 370 can be collected atvarious devices connected to the Internet. For example, gateway 320, ISP330 can store one or more data privacy elements that can exposeinformation about laptop 310 because laptop 310 communicates withgateway 320 and ISP 330 to connect with secure server 350. While theexposable data privacy elements 370 can be collected at gateway 320, ISP330, or secure server 350 (e.g., by network host 360), gateway 320, ISP330, and secure server 350 may or may not be the source of the exposabledata privacy elements. For example, the browser running on laptop 310can expose certain information about the Operating System (OS) installedon laptop 310, but that OS information may be collected by a web serverwhen the web server queries the browser, or when network host 360accesses the OS information in an unauthorized manner (e.g., by hackingthe web server to gain access to the stored OS information).

Referring again to FIG. 4, in some implementations, the addition of dataprotection platform 440 into network environment 300 (as represented bynetwork environment 400), can control the exposure of data privacyelements as laptop 410 navigates the Internet. In FIG. 4, gateway 420may be the same as or similar to gateway 320, ISP 430 may be the same asor similar to ISP 330, network 450 may be the same as or similar tonetwork 340, and secure server 460 may be the same as or similar tosecure server 350, and thus, a description of these devices is omittedfor the sake of brevity. In some implementations, data protectionplatform 440 can provide a platform-secured browser for laptop 410. Asthe user navigates the Internet using the platform-secured browser, dataprotection platform 440 can block, modify, and/or observe the dataprivacy elements (e.g., at block 470) that are exposed to devices acrossthe Internet.

Continuing with the example described in FIG. 4, when a web serverqueries the platform-secured browser, the data protection platform 440can block the OS information from being provided to the web server. Asanother example, the data protection platform 440 can modify the OSinformation (e.g., using an artificial dynamic model profile), andprovide the modified OS information to the web server. According tocertain embodiments, network host 480 may collect artificial exposabledata privacy elements 495 at block 490, however, the collected dataprivacy elements obfuscate the actual information about the useroperating system, the platform-secured browser, or laptop 410 itself.Advantageously, the collected exposable data privacy elements 495 wouldnot expose any real vulnerabilities of laptop 410.

As noted above in FIG. 4, the browser running on laptop 410 can interactwith secure server 460, and exposable data privacy elements 470 can becollected at various devices connected to the Internet. As noted above,gateway 420 and ISP 430 can store one or more data privacy elements thatcan expose information about laptop 410 because laptop 410 communicateswith gateway 420 and ISP 430 to connect with secure server 460. Forexample, platform-secured network element 380 can be added into networkenvironment 400 at a point between laptop 410 and gateway 420.

FIG. 5 is a schematic diagram illustrating data protection platform 500,according to certain aspects of the present disclosure. In someimplementations, data protection platform 500 may be implemented usingcloud-based network 510. For example, data protection platform 500 maybe an application that is deployed in cloud-based network 510. Dataprotection platform 500 in cloud-based network 510 may include anapplication server (not shown) that is constructed using virtual CPUsthat are assigned to or reserved for use by data protection platform500. Further, data protection platform 500 may be implemented using oneor more containers. Each container can control the exposure of dataprivacy elements. A container may include stand-alone, executable codethat can be executed at runtime with all necessary components, such asbinary code, system tools, libraries, settings, and so on. However,because containers are a package with all necessary components to runthe executable code, the container can be executed in any networkenvironment in a way that is isolated from its environment. It will beappreciated that any number of cloud-based networks can be used toimplement data protection platform 500. For example, assuming dataprotection platform 500 is implemented using a set of containers, asubset of the set of containers can be deployed on cloud-based network510, another subset of the set of containers can be deployed oncloud-based network 520, another subset of the set of containers can bedeployed on cloud-based network 530, and so on. It will also beappreciated that data protection platform 500 may or may not beimplemented using a cloud-based network.

Referring to the non-limiting example illustration of FIG. 5, dataprotection platform 500 can include a number of containers that aredeployed using cloud-based network 510. For instance, data protectionplatform 500 can include secure browser 551, secure routing container552, real-time monitoring container 553, profile management container554, AI container 555, external integration container 556, profilehistory database 557, profile model database 558, and content database559. Further, data protection platform 500 may control the exposure ofdata privacy elements that are exposable during a browsing sessionbetween a computing device (e.g., laptop 410 of FIG. 4) and secureserver 550 on network 540.

In some implementations, secure browser 551 may be a container thatincludes executable code that, when executed, provides a virtual,cloud-based browser to the computer device. For example, theplatform-secured browser running on laptop 410 shown in FIG. 4 may beprovided by the data protection platform 500 using secure browser 551.In some implementations, secure routing container 552 may be a containerthat includes executable code that, when executed, provides thecomputing device with a virtual private network (VPN) to exchangecommunications between the computing device and the data protectionplatform 500. Secure routing container 552 can also facilitate therouting of communications from the computing device or from anycontainer within data protection platform 500 to other devices orcontainers internal or external to data protection platform 500. Forexample, if data protection platform 500 is implemented across severalcloud-based networks, then secure routing container 552 can securelyroute communications between containers across the several cloud-basednetworks. Real-time monitoring container 553 can be a containerincluding executable code that, when executed, monitors the exposabledata privacy elements associated with a browsing session in real-time.For example, if a computing device connects with a web server to accessa search engine website, real-time monitoring container 553 can monitorthe user input received at the search engine website as the user typesin the input. In some implementations, real-time monitoring container553 can control the exposure of behavioral/real-time attribution vectors(e.g., attribution vectors 730, which are described in greater detailwith respect to FIG. 7). For example, real-time monitoring container 553may modify the input dynamics of keystroke events, as described ingreater detail with respect to FIG. 11.

Profile management container 554 can include executable code that, whenexecuted, controls or manages the artificial profiles that have beencreated and stored. For example, profile management container 554 canuse artificial intelligence (e.g., Type II Limited Memory) provided byAI container 555 to generate a new artificial profile based on theartificial profile model (e.g., artificial profile model 700 describedin greater detail with respect to FIG. 7) and/or administrator enteredconstraints (e.g., region, demographic, protection level requirements)to ensure that newly created or modified artificial profiles arecompliant with previously generated profiles stored in the profilehistory database 557. AI container 555 can include executable code that,when executed, performs the one or more machine-learning algorithms on adata set of all available data privacy elements to generate theartificial profile model. The generated artificial profile model can bestored at profile model database 558. Further, external integrationcontainer 556 can include executable code that, when executed, enablesthird-party systems to integrate into data protection platform 500. Forexample, if an organization seeks to use data protection platform 500 tocontrol the exposure of data privacy elements for all employees of theorganization, external integration container 556 can facilitate theintegration of the third-party systems operated by the organizations.Content database 559 may store content data associated with browsingsessions in a content file system. For example, if during a browsingsession between a computing device and a web server, the user operatingthe browser determines that content data should be stored from the webserver, that content data can be stored in content database 559 and thecontent file system can be updated.

It will be appreciated that data protection platform 500 may include anynumber of containers to control the exposure of data privacy elementsduring webpage or application navigation. It will also be appreciatedthat data protection platform 500 is not limited to the use ofcontainers to implement controlling data privacy elements. Any othersystem or engine may be used in data protection platform 500 toimplement controlling data privacy elements, in addition to or in lieuof the use of containers.

FIG. 6 is a block diagram illustrating non-limiting example 600, whichincludes a non-exhaustive set 610 of data privacy elements that can beexposed to network hosts or any other device within a network. FIG. 6 isprovided to describe in greater detail the various data privacy elementsassociated with a particular browser, computing device, or network. Forexample, non-exhaustive set 610 includes the various data privacyelements that can be exposed to network hosts during online activityperformed by a computing device, such as computing device 310 of FIG. 3.Further, the data privacy elements included in non-exhaustive set 610may also be collected while the computing device is not browsing theInternet or interacting with an application. For example, even thoughthe computing device may not currently be accessing the Internet, one ormore data privacy elements may nonetheless be stored at a gateway, anISP server, or a secure server on the Internet. The stored one or moredata privacy elements may have been collected during a previousinteraction with the computing device. In this example, the stored oneor more data privacy elements are still exposed because a network hostcan access the stored one or more data privacy elements even while thecomputing device is not currently accessing the Internet.

In some implementations, non-exhaustive set 610 may include data privacyelements 620, which are related to the online activity of a user.Non-limiting examples of the activity of a user may include anyinteraction between user input devices and a browser (e.g., the userentering text into a website using a keyboard), the browser and a webserver (e.g., the browser requesting access to a webpage by transmittingthe request to a web server, the search history of a browser, thebrowsing history of a browser), the browser and an application server(e.g., the browser requesting access to an application by transmittingthe request to the application server), the browser and a databaseserver (e.g., the browser requesting access to one or more files storedat a remote database), the browser and the computing device on which thebrowser is running (e.g., the browser storing data from a cookie on thehard drive of the computing device), the computing device and any deviceon a network (e.g., the computing device automatically pinging a serverto request a software update), and any other suitable data representingan activity or interaction. In some implementations, data privacyelements 620 may also include a detection of no activity or nointeractions during a time period, for example, a period of time of nouser interaction or user activity.

In some implementations, data privacy elements 620 may includeinformation about input received at a browser, but that was notultimately transmitted to the web server due to subsequent activity bythe user. For example, if a user types in certain text into an inputfield displayed on a webpage, but then deletes that text withoutpressing any buttons (e.g., a “send” button), that entered text maynonetheless be an exposable data privacy element that can revealinformation about the user, even though that entered text was nevertransmitted to a web server. It will be appreciated that the presentdisclosure is not limited to the examples of data privacy elements 620described herein. Other data privacy elements related to a user'sactivity or non-activity that is not mentioned here, may still be withinthe scope of the present disclosure.

In some implementations, non-exhaustive set 610 may include data privacyelements 630, which are related to information about networks and/ornetwork configurations. Non-limiting examples of information about anetwork may include a network topology (e.g., how many web servers,application servers, or database servers are included in the network,and how are they connected); network security information (e.g., whichCertificate Authorities (CAs) are trusted, which security protocols areused for communicating between devices, the existence of any detectedhoneypots in the network, and so on); the versions of security softwareused in the network; the physical locations of any computing devices,servers, or databases; the number of devices connected to a network; theidentify of other networks connected to a network; the IP addresses ofdevices within the network; particular device identifiers of devices,such as a media access control (MAC) address; the SSID of any gatewaysor access points; the number of gateways or access points; and any othersuitable data privacy element related to network information. Networkhosts can evaluate data privacy elements 630 to identify and exploitvulnerabilities in the network. It will be appreciated that the presentdisclosure is not limited to the examples of data privacy elements 630described herein. Other data privacy elements related to a network thatare not mentioned here, may still be within the scope of the presentdisclosure.

In some implementations, non-exhaustive set 610 may include data privacyelements 640, which are related to information about applications storedon the computing device or accessed by the computing device.Non-limiting examples of application information may include an identityof one or more applications installed on the computing device; anidentify of one or more applications accessed by the computing device(e.g., which web applications were accessed by the computing device); asoftware version of one or more applications installed on the computingdevice; an identity of one or more applications that were recently ornot recently uninstalled from the computing device; the usage of one ormore applications installed on the computing device (e.g., how manytimes did the user click or tap on the execution file of theapplication); whether an application is a native application stored on amobile device or a web application stored on a web server or applicationserver; an identity of one or more applications that are active in thebackground (e.g., applications that are open and running on thecomputing device, but that the user is not currently using); an identifyof one or more applications that are currently experiencing userinteraction; the history of software updates of an application; and anyother suitable data privacy element relating to applications. It will beappreciated that the present disclosure is not limited to the examplesof data privacy elements 640 described herein. Other data privacyelements related to an application that are not mentioned here, maystill be within the scope of the present disclosure.

In some implementations, non-exhaustive set 610 may include data privacyelements 650, which expose information about the OS installed on thecomputing device. Non-limiting examples of OS information may include anidentity of the OS installed on the computing device; a version of theOS installed on the computing device; a history of the updates of theOS; an identity of a destination server with which the computing devicecommunicated during any of the updates; an identification of patchesthat were downloaded; an identification of patches that were notdownloaded; and identification of updates that were downloaded, but notproperly installed; system configurations of the OS; the settings or thehardware-software arrangement; system setting files; activity logged bythe OS; an identity of another OS installed on the computing device, ifmore than one; and any other suitable data privacy element relating tothe OS currently installed or previously installed on the computingdevice. It will be appreciated that the present disclosure is notlimited to the examples of data privacy elements 650 described herein.Other data privacy elements related to the OS that are not mentionedhere, may still be within the scope of the present disclosure.

In some implementations, non-exhaustive set 610 may include data privacyelements 660, which expose information about the hardware components ofthe computing device. Non-limiting examples of hardware information mayinclude an identity of the various hardware components installed on thecomputing device; an identify of any firmware installed on the computingdevice; an identity of any drivers downloaded on the computing device tooperate a hardware component; configuration settings of any hardwarecomponent, firmware, or driver installed on the computing device; a logof which external hardware devices have been connected to the computingdevice and which ports were used (e.g., Universal Serial Bus (USB)port); the usage of a hardware component (e.g., the CPU usage at a giventime); an identify of any hardware components that are paired with thecomputing device over a short-range communication channel, such asBluetooth (e.g., has the computing device connected to a smart watch, avirtual-reality headset, a Bluetooth headset, and so on); and any otherdata privacy elements that relate to hardware information. It will beappreciated that the present disclosure is not limited to the examplesof data privacy elements 660 described herein. Other data privacyelements related to the hardware components of the computing device orother associated devices (e.g., a virtual-reality headset) that are notmentioned here, may still be within the scope of the present disclosure.It will also be appreciated that non-exhaustive set 610 may also includedata privacy elements 670 that are not described above, but that arewithin the scope of the present disclosure. Further, there may or maynot be overlap between data privacy elements 620, 630, 640, 650, 660,and 670.

While FIG. 6 illustrates a non-exhaustive set of data privacy elementsthat may be exposed by the user, the browser running on the computingdevice, the computing device itself, or any device that the computingdevice interacted with, certain embodiments of the present disclosureinclude generating a model for creating artificial profiles based on thenon-exhaustive set 610 of data privacy elements. The model may begenerated using one or more machine-learning techniques and/or one ormore AI techniques, as described in further detail with respect to FIG.7.

FIG. 7 is a block diagram illustrating a non-limiting example of anartificial profile model 700, according to certain aspects of thepresent disclosure. As described above, certain embodiments provide forgenerating an artificial profile model, which can be used as the basisfor creating artificial profiles for users navigating the Internet. Theadvantage of using an artificial profile model as the basis for creatingor modifying artificial profiles is that the artificial profile modelensures that the newly created or modified artificial profiles areconsistent with constraints, relationships and/or dependencies betweendata privacy elements. Maintaining consistency with the constraints,relationships and/or dependencies that are defined in the artificialprofile model makes for more realistic artificial profiles. Further,realistic artificial profiles advantageously decrease the likelihoodthat a network host will flag an artificial profile as fake, while atthe same time obfuscates or blocks information about the user, browser,or computing device.

In some implementations, artificial profile model 700 may be trained byexecuting one or more machine-learning algorithms on a data setincluding non-exhaustive set 610 of FIG. 6. For example, one or moreclustering algorithms may be executed on the data set includingnon-exhaustive set 610 to identify clusters of data privacy elementsthat relate to each other or patterns of dependencies within the dataset. The data protection platform can execute the clustering algorithmsto identify patterns within the data set, which can then be used togenerate artificial profile model 700. Non-limiting examples ofmachine-learning algorithms or techniques can include artificial neuralnetworks (including backpropagation, Boltzmann machines, etc.), bayesianstatistics (e.g., bayesian networks or knowledge bases), logisticalmodel trees, support vector machines, information fuzzy networks, HiddenMarkov models, hierarchical clustering (unsupervised), self-organizingmaps, clustering techniques, and other suitable machine-learningtechniques (supervised or unsupervised). For example, the dataprotection platform can retrieve one or more machine-learning algorithmsstored in a database (not shown) to generate an artificial neuralnetwork in order to identify patterns or correlations within the dataset of data privacy elements (i.e., within non-exhaustive set 610). As afurther example, the artificial neural network can learn that when dataprivacy element #1 (in the data set) includes value A and value B, thendata privacy element #2 is predicted as relevant data for data privacyelement #1. Thus, a constrain, relationship and/or dependency can bedefined between data privacy element #1 and data privacy element #2,such that any newly created or modified artificial profiles should beconsistent with the relationship between data privacy elements #1 and#2. In yet another example, a support vector machine can be used eitherto generate output data that is used as a prediction, or to identifylearned patterns within the data set. The one or more machine-learningalgorithms may relate to unsupervised learning techniques, however, thepresent disclosure is not limited thereto. Supervised learningtechniques may also be implemented. In some implementations, executingthe one or more machine-learning algorithms may generate a plurality ofnodes and one or more correlations between at least two nodes of theplurality of nodes. For example, the one or more machine-learningalgorithms in these implementations can include unsupervised learningtechniques, such as clustering techniques, artificial neural networks,association rule learning, and so on.

In some implementations, the data protection platform can map dataprivacy elements to a machine-learning model (e.g., artificial profilemodel 700), which includes a plurality of nodes and one or morecorrelations between at least two nodes. Based on the mapping and theone or more correlations, the data protection platform can intelligentlypredict or recommend other data privacy elements that are related to,dependent upon, and/or correlated with data privacy elements included inan existing artificial profile (e.g., in the case of modifying anartificial profile). The execution of the one or more machine-learningalgorithms can generate a plurality of nodes and one or morecorrelations between at least two nodes of the plurality of nodes. Eachnode can represent a value associated with a data privacy element andcorrespond to a weight determined by the machine-learning algorithms. Inthe case of creating new artificial profiles, the data privacy elementsincluded in the newly-created profiles can include a set of data privacyelements that are consistent with any relationships or dependenciesidentified in artificial profile model 700, and thus, realisticartificial profiles can be created. In the case of modifying existingartificial profiles, the data privacy elements included in the existingartificial profile can be modified in a manner that is consistent withthe relationship and dependencies that are identified in artificialprofile model 700, and thus, existing artificial profiles can beobfuscated, such that the obfuscated profile would appear to berealistic.

To illustrate and only as a non-limiting example, artificial profilemodel 700 may be the result of executing one or more clusteringalgorithms on non-exhaustive set 610. The clustering algorithm may haveidentified that non-exhaustive set 610 included several distinctgroupings or clusters of data privacy elements. For example, theclusters may be identified based on one or more similarities betweenvalues of the data privacy elements. In some implementations, theclusters of data privacy elements may be referred to as attributionvectors 710. Further, the clusters of data privacy elements may includeenvironment/non-interactive attribution vector 720, behavior/real-timeattribution vector 730, behavioral/non-real-time attribution vector 740,and activity and patterns attribution vector 750. It will be appreciatedthat any number of attribution vectors or clusters may be determined inartificial profile model 700, and that environment/non-interactiveattribution vector 720, behavior/real-time attribution vector 730,behavioral/non-real-time attribution vector 740, and activity andpatterns attribution vector 750 are merely non-limiting examples ofidentifiable clusters of data privacy elements. The present disclosureis not limited to the attribution vectors illustrated in FIG. 7.

Continuing with the non-limiting example, environmental/non-interactiveattribution vector 720 may correspond to data privacy elements that areclustered together based on environmental or non-interactive attributesof a computing device or browser. Environmental or non-interactiveattributes, in this example, may refer to attributes that are notrelated or dependent upon a user interaction with a webpage, or that arerelated to environment attributes of a computer. For example,attribution vectors 720 may include data privacy elements relating tohardware components of a computing device; browser attributes, such asfonts used, browser type, or installed web apps; and OS attributes, suchas fonts used by the OS, OS version, information about software updates(e.g., update schedule and IP addresses of update distribution servers),and applications installed in the OS. Additionally, the machine-learningalgorithms may have identified patterns in the data privacy elementsclustered as environment/non-interactive attribution vectors 720. Forexample, the dashed line between “hardware” and “browser” in FIG. 7indicates that the hardware information is relevant data for the browserinformation (e.g., the types of browsers that can be downloaded on thecomputing device are constrained by the hardware information). Asanother example, the dashed line between “fonts” and “applications” inFIG. 7 indicates that the data privacy elements relating to the fontsavailable in the OS are correlated or dependent on the applicationsinstalled in the OS.

In some implementations, behavioral/real-time attribution vector 730 maycorrespond to data privacy elements that are clustered together based onreal-time attributes of a user input (e.g., input or keystroke dynamicsof user input received at a browser). Behavioral real-time attributes,in this example, may refer to attributes that are related to ordependent upon real-time user interaction with a webpage, such as mousemovements, mouse clicks, or text inputs. For example, attributionvectors 730 may include data privacy elements relating to inputprofiling based on keystroke events and/or mouse movements. Inputprofiling will be described in greater detail below with respect to FIG.11. Data privacy elements relating to real-time input can be exposed tonetwork hosts and exploited to reveal information about the user.

In some implementations, behavior/non-real-time attribution vector 740may correspond to data privacy elements that are clustered togetherbased on non-real-time attributes of a user input. Behavioralnon-real-time attributes, in this example, may refer to attributes thatare determined based on aggregated information from previous onlineactivity performed by the user. For example, attribution vectors 740 mayinclude data privacy elements relating to the average duration ofactivity on webpages, a bounce rate indicating an average time spend ona webpage before navigating away from the webpage, statistics aboutclickstream data, and other suitable non-real-time attributes of userinput. Attribution vectors 730 and 740 differ in that the data privacyelements relating to attribution vector 730 are based on in-the-momenttext input or mouse movements, whereas, data privacy elements relatingto attribution vector 740 are based on an evaluation of aggregated dataassociated with user input.

In some implementations, activity and patterns attribution vector 750may correspond to data privacy elements that are clustered togetherbased on the content of user input. Activity and patterns attributes, inthis example, may refer to attributes that are determined based on thecontent of the input entered into a browser by a user. For example,attribution vectors 750 may include a data privacy element that exposesthe browsing history of the user, the dialect or idiosyncrasies used bythe user, the user's engagement with content (e.g., tapping or clickingon advertisement content), and/or any other suitable activity- orpattern-based data privacy elements.

It will be appreciated that artificial profile models may be used bydata broker companies (e.g., in an advertising context), while stillprotecting user privacy. As a non-limiting example and for illustrativepurposes only, a user of the data protection platform may utilize aprofile to interact with another user or party. Through a trustrelationship with that other user or party, the user may select whichdata privacy elements to expose to the other user or party. Asnon-limiting examples, the selected data privacy elements can be exposedto the other user or party by passing information along via HTTPheaders, HTTP verbs (e.g. POST), or other techniques, such as a YAML(YAML Ain′t Markup Language) or XML (Extensible Markup Language). Insome implementations, the selected data privacy elements can last forthe duration of an online session, can be manually or automaticallymodified during the online session, or can be automatically modifiedafter each session. For example, an online session may begin when a userlogs into the data protection platform. When the user logs into the dataprotection platform, an artificial profile may be generated for theuser, and that artificial profile may include data privacy elements thatare the same or different (entirely or partially) as the data privacyelements of the last artificial profile generated for the user. Further,since many existing exploit and exploit techniques are detectable bymodern firewalls, the data protection platform can generate artificialprofiles to overtly pretend to have vulnerabilities that an organizationis capable of defending against. Accordingly, network attacks by networkhosts, such as hackers, are inhibited because the network hosts mayattempt network attacks based on inaccurate information, the network'sfirewalls are stopping the attack attempts (and the network attacks thatmay succeed in accessing the network will likely fail because the dataprotection platform may be a hybrid mix of containers and inaccurateinformation).

FIGS. 8A-8B are block diagrams illustrating artificial profilesgenerated using the artificial profile model illustrated in FIG. 7,according to certain aspects of the present disclosure. FIG. 8Aillustrates artificial profile 800A, which represents the data privacyelements that are exposed to a web server when a computing device loadsa website, for example. For the purpose of illustration and only as anon-limiting example, artificial profile 800A may include fourattribution vectors. The four attribution vectors may includeenvironmental/non-interactive attribution vector 810, behavioralreal-time attribution vector 820, behavioral non-real-time attributionvector 830, and activity and patterns attribution vector 840. In someimplementations, an attribution vector may be a category, grouping, orclassification of data privacy elements.

Environmental/non-interactive attribution vector 810 may be detectedwhen the computing device loads the webpage. Environment/non-interactiveattribution vector 810 may include data privacy element 815, whichindicates a type of browser running on the computing device. Forexample, browser type A (e.g., the GOOGLE CHROME browser may be abrowser type, and the MOZILLA FIREFOX browser may be another browsertype) may be a value of data privacy element 815, which may be detectedwhen computing device loads the webpage. Behavioral real-timeattribution vector 820 may include data privacy element 825, whichindicates a real-time input signature associated with the input receivedat the computing device by the user. The input signature of inputreceived at the computing device is described in greater detail withrespect to FIG. 11. For example, an input signature of “English” (e.g.,detected based on the key dynamics of the input indicating that theletters “TING” are typed sequentially without a pause by the user) maybe a value of data privacy element 825, which may be detected whencomputing device interacts with the webpage. Behavioral non-real-timeattribution vector 830 may include data privacy element 835, whichindicates a non-real-time input signature associated with previousinputs received at the computing device while accessing the website orother websites. For example, an input signature of “English” may be avalue of data privacy element 835, which may be detected when computingdevice interacts with the webpage or any other webpage at a previoustime. Behavioral real-time attribution vector 820 detects, analyzes, andprofiles input in real-time as the inputs are being entered by the useroperating the computing device, whereas, behavioral non-real-timeattribute vector 830 represents a behavioral pattern associated with theuser operating the computing device, but which occurred in the past.Lastly, activity and patterns attribution vector 840 may include dataprivacy element 845, which indicates an activity or pattern of theOperating System (OS) installed on the computing device. For example, anactivity or pattern of the detected OS may be that the OS transmits asignal to XYZ.com daily at 6:00 a.m. For example, XYZ.com may be awebsite that stores or distributes patches for the OS. The signal thatis transmitted daily from the OS of the computing device may correspondto a request to download new patches, if any.

While artificial profile 800A represents the real data privacy elementsthat were exposed to the web server hosting the website accessed by thecomputing device, new artificial profile 800B represents the modifiedartificial profile. For example, data protection platform can generatenew artificial profile 800B by modifying data privacy elements ofartificial profile 800A. Further, data protection platform may modifyartificial profile 800A based on an artificial profile model. Theartificial profile model may be a model that is generated usingmachine-learning techniques, and that includes one or more dependencesor relationships between two or more data privacy elements. Accordingly,when new artificial profile 800B is generated, the data privacy elementsof artificial profile 800A that are modified are done so within theconstraints of the artificial profile model, so as to obfuscate the userwith a realistic artificial profile. Advantageously, obfuscatinginformation about a user in a realistic manner is more likely to cause apotential hacker to accept the obfuscated information as the realinformation of the user. Conversely, by modifying artificial profileswithout being consistent with underlying dependencies and relationshipsbetween data privacy elements, a the potential hacker may recognize theinconsistent as a flag indicating that the artificial profile isincludes inaccurate or obfuscated information. If a potential hackerrecognizes that the collected data privacy elements are obfuscated, thepotential hacker may be more likely to continue a data breach usingalternative approaches, potentially elevating the severity of an attackon the network.

Continuing with the non-limiting example illustrated in FIG. 8B, thedata protection platform can generate new artificial profile 800B (e.g.,a modified version of artificial profile 800A) for the user to obfuscateor mask the user's real data privacy elements (e.g., the data privacyelements included in profile 800A). In some implementations, newartificial profile 800B may include the same attribution vectors asartificial profile 800A, however, the present disclosure is not limitedthereto. In some implementations, new artificial profile 800B mayinclude more or less attribution vectors than the underlying artificialprofile that is being modified. Environmental/non-interactiveattribution vector 850, behavioral real-time attribution vector 860,behavioral non-real-time attribution vector 870, and activity andpatterns attribution vector 880 may each correspond to its respectiveattribution vector in artificial profile 800A, however, the value (e.g.,the data underlying the data privacy element) may have been changed. Forexample, the data protection platform may modify data privacy element815 from “Browser type A” to “Browser type B” (e.g., from a GOOGLECHROME browser to a FIREFOX browser). In some implementations, dataprivacy element 815 is modified before a network host, such as a webserver providing access to a webpage, can collect any data from thebrowser of the computing device or from the computing device itself.When the network host collects data privacy elements from the computingdevice (e.g., a web server collected data privacy elements from thebrowser operating on the computing device), the network host willcollect the obfuscated data privacy element 855, which indicates thatBrowser type B is being used, instead of data privacy element 815, whichindicates the actual browser being used by the user.

The data protection platform may modify data privacy element 825 from“input signature=English” to “input signature=Undetectable.” In someimplementations, data privacy element 825 is modified before a networkhost, such as a web server providing access to a webpage, can collectany data from the browser of the computing device or from the computingdevice itself. When the network host collects data privacy elements fromthe computing device (e.g., a web server receiving input entered by theuser at the computing device), the network host will collect theobfuscated data privacy element 865, which indicates that the inputsignature is undetectable, instead of data privacy element 825, whichindicates the input signature indicates a likelihood that the user is anEnglish speaker. The data protection platform can change the inputsignature (e.g., input dynamics) of user input received at the computingdevice using techniques described in greater detail with respect to FIG.11. However, as a brief summary, the data protection platform can changethe time signature associated with the inputted keystroke events so asto obfuscate any detectable key event features, such as the letters“TING” being typed together without a pause (indicating that the user islikely a native English speaker). Similarly, the data protectionplatform can modify data privacy element 835 from “previous inputsignature=English” to “previous input signature=undetectable.” Just aswith the modification of data privacy element 825 to data privacyelement 865, the data protection platform can modify data privacyelement 835 to data privacy element 875 using the same or similartechnique (e.g., the techniques described in FIG. 11).

The data protection platform may modify data privacy element 845 from“Operating System pings XYZ.com daily at 0600 for patches” to “OperatingSystem pings A1B2C3.com biweekly at 2300 for patches” (e.g., oneOperating System's automatic update procedure to another OperatingSystem's automatic update procedure). In some implementations, dataprivacy element 845 is modified before a network host, such as a webserver providing access to a webpage, can collect any data from thebrowser of the computing device or from the computing device itself.When the network host collects data privacy elements from the computingdevice (e.g., a web server collected data privacy elements from thebrowser operating on the computing device), the network host willcollect the obfuscated data privacy element 885, which indicates that athe OS pings an external server on a regular schedule, instead of dataprivacy element 845, which indicates the actual automatic updateschedule of the OS installed on the computing device. Had the networkhost collected data privacy element 845 from the browser of thecomputing device, the network host could have identified and exploited avulnerability in the OS installed on the computing device, or avulnerability in the servers of XYZ.com. However, advantageously, sincethe network host instead collected modified data privacy element 885 (aspart of collecting modified artificial profile 800B from the browser orcomputing device), the network host collected realistic, yet obfuscated,information about the browser and computing device. Thus, the networkhost cannot effectively mount an attack on the network or the computingdevice because modified artificial profile 800B does not expose any realvulnerabilities existing in the browser or the computing.

In some implementations, the data protection platform does not need togenerate artificial profile 800A, which includes data privacy elementsthat were actually detected from the browser or computing device.Instead, the data protection platform can automatically and dynamicallygenerate modified artificial profile 800B, while or in conjunction with,the user browsing webpages on the Internet. In these implementations,the data protection platform does not need to detect the actual dataprivacy elements exposed by the computing device, but rather, the dataprotection platform can generate an artificial profile for the user,browser, or computing device, so as to obfuscate any potentiallyexposable data privacy elements.

In some embodiments, the data privacy elements can be modifiedperiodically or continuously over time such that sequential artificialprofiles cannot be tracked from one artificial profile to another, as isshown in the non-limiting example illustrated in FIG. 8C. In an exampleembodiment, the data protection platform can generate new artificialprofile 800C (e.g., a modified version of artificial profile 800B) thatobfuscates or masks the data privacy elements included in artificialprofile 800B. In some implementations, new artificial profile 800C mayinclude the same attribution vectors as artificial profile 800B,although the present disclosure is not limited thereto (e.g., in someimplementations, artificial profile 800C may include more or lessattribution vectors than artificial profile 800B, the previousartificial profile that has been modified to produce the new artificialprofile). Modifying one or more data privacy elements over time preventsan artificial profile from being trackable and compromised because eachiteration of the artificial profile prevents the profile from beingrelated to its previous version. For example, a minimal amount of dataprivacy elements can be modified from artificial profile 800B at aspecific time (time=t1) to create the non-trackable and protectedartificial profile 800C. In this example embodiment, the data protectionplatform can modify data privacy element 855 from “Browser Type B” to“OS Type A/Browser Type Bv31” to create artificial profile 800B. At asubsequent time (e.g., time=t2), the data protection platform can createartificial profile 800C by modifying data elements 855 and 885 ofartificial profile 800B from “OS Type A/Browser Type Bv31” to “OS TypeA/Browser Type Bv12” and “Operating system pings A1B2C3.com biweekly at2300 for patches” to “No OS ping”, respectively, to create artificialprofile 800D. In some implementations, the data privacy elements aremodified before a network host, such as a web server providing access toa webpage, can collect any data from the browser of the computing deviceor the computing device itself. When the network host collects the dataprivacy elements from artificial profile 800C, the network host willcollect the modified data privacy element 855 and data privacy element885, which indicates that Browser Type Bv12 is being used and detectsthe OS version based on the modification of the OS versions andmaintenance communications (e.g. ping), instead of the actual browsertype used and/or user activity.

Had the network host collected the browser type and/or the OS activityfrom artificial profile 800C without being modified over time, thenetwork host could have identified and exploited a vulnerability in theartificial profile model that generates the artificial profile(s).However, since the network host collected realistic, yet obfuscated,information about the browser and the computing device that changes overtime, the network host cannot effectively mount an attack against abrowser and computing device that is seemingly inconsistent from oneartificial profile to the next artificial profile. Moreover, the networkhost would not realize that the artificial profiles are masking the samecomputing device. To the network host, the computing device forartificial profile 800A would be distinct from the computing device forartificial profile 800B, which would be distinct from the computingdevice for artificial profile 800C, etc. FIG. 9A illustrates an examplesystem for generating artificial profiles that change over time usingthe artificial profile models illustrated in FIG. 8C, according tocertain aspects of the present disclosure. System 902 can includeprofile generation service 904 that aggregates data privacy elements forinclusion in a user profile. The data privacy elements can be modifiedto create artificial profiles by variable generation service 906, whichcan use an artificial profile model (such as described in FIG. 7) as thebasis for modifying data privacy elements such that newly created ormodified artificial profiles are consistent with constraints,relationships, and/or dependencies between data privacy elements. Thisensures that the artificial profiles, which are stored within protectedprofiles database 908, appear realistic over each iteration such that anetwork host would not flag the artificial profile as fake, while at thesame time obfuscating or blocking information about the true underlyinguser, browser, and/or computing device.

In some embodiments, moving target defense service 910 can select one ormore artificial profiles from protected profiles database 908 tocontinuously modify one or more data privacy elements within eachartificial profile. The moving target defense service 910 can select anynumber of candidate artificial profiles to continually modify in orderto frustrate any malware mechanism looking for patterns or actualrelationships between the data privacy elements. In some embodiments,the moving target defense service 910 can perform an effectively endlessnumber of artificial profile iterations.

In the example shown, the moving target defense service 910 has selectedartificial profile 800A and modified data privacy element 855 togenerate artificial profile 800B (as discussed in FIG. 8C). The modifieddata privacy element 855 can be changed by variable generation service906 in such a way that it's consistent with the constraints,relationships, and/or dependencies between other data privacy elementsin artificial profile 800B. At a subsequent time, moving target defenseservice 910 triggers another modification to artificial profile 800B tocreate artificial profile 800C. In the example shown, for example, dataprivacy element 885 was modified.

The moving target defense service 910 can be triggered to modify one ormore data elements in each artificial profile in a number of ways. Insome embodiments, a user can initiate the change to the artificialprofile. In some embodiments, the change to the artificial profile canbe automatically initiated by the data protection platform. For example,the artificial profile can be refreshed/modified on a periodic basis,such as every session, every hour, every day, every week, etc.Alternatively, the artificial profile can be dynamically modified inresponse to a triggering event, such as an event that indicates asecurity issue. For example, the triggering event can be related topossible intrusion features detected by an intrusion detection service,such as malware signatures or program execution events with parametersincluding, but not limited to: suspicious APIs called, instructionsexecuted, IP addresses accessed, etc.

FIG. 9B illustrates an example embodiment of artificial profiles thatare generated using data profile seeding techniques, according tocertain aspects of the present disclosure. In some instances, system 902of an organization or enterprise can generate artificial profiles withattributes that lead back to the organization, but not to any individualemployee of the organization. In this way, a network host trying tofind/exploit vulnerabilities within the organization would find theartificial profiles more realistic, and as a result would base theirattacks off the artificial profiles rather than trying to uncover realprofiles.

The above can be accomplished through data profile seeding, which seedsthe data privacy elements with constraints, relationships, and/ordependencies that are indicative of the organization. To createrealistic organization specific profiles, seeding data can be gatheredfrom the current computing environment for the organization (manually orautomatically). For example, system 902 can include a data extractionservice 912 that can request data about user attributes associated withthe organization. In some embodiments, the data can be requested from,but not limited to, a mobile device management system 914, aconfiguration/asset management database 916, or other similar system 918that contain user attribute data. The user attribute data may in someembodiments be based on organizational policies, regularly compliance ormission objectives. These can include user information, online behaviorand patterns, device information associated with individual users,specific IP ranges, preferred geographic locations, language settings,OS emulation, etc. The data extraction service 912 can store anyorganization specific features, attributes, or signatures within currentorganization signature data store 920.

In some embodiments, profile generation service 922 can generateartificial profiles seeded with organization specific signatures.Organization specific signatures can be those signatures that havecharacteristics that allow an attacker/observer/etc. to differentiatedata generated by that organization—i.e. track their activities. Forexample, organization specific signatures can be related tocorporate-created standard laptop configurations for all employees meantto standardize security, applications and operating systemconfigurations. A classic example is the fact that Booz computers hadthe Harvey Balls font installed by default on their systems—a font Boozdeveloped many years ago. The presence of that font would be a strongindicator that the machine in question is a Booz machine, and that theuser in question is likely a Booz employee. These types of standardprofiles mean if there is a tracking element or security vulnerability,it is pervasive across thousands of devices, and can expose most of thecorporate activity to tracking and monitoring by third parties. While itis easier for the organization's administrators to scan network trafficto identify networking stacks (TCP/IP fingerprinting), perform browserfingerprints, etc. in order to build a profile of a user made up oforganization specific signatures, an attacker can do so without theircooperation (such as by scanning traffic themselves). To combat this,profile generation service 922 can generate artificial profiles seededwith modified organization specific signatures

For example, organization variable generation service 924 can determineand develop relationships between the features, attributes, orsignatures within current organization signature data store 920 in orderto build one or more models based on the organization. For example, byextracting the OS, application, and/or other system configurationelements from configuration/asset management database 916, system 902can build one of more models by copying those elements and thenmodifying them to prevent surveillance and tracking.

In some embodiments, current organization signature data store 920 cantrain one or more artificial intelligence (AI) or machine learned (ML)models that can dynamically determine organization specificrelationships. Profile generation service 922 can use the models tomodify data privacy elements in such a way that the data privacyelements within each artificial profile are consistent with constraints,relationships, and/or dependencies that would be seen in a real profile.These artificial profiles can be stored as protected profiles 925.

For example, in the example embodiment shown, the models created byorganization variable generation service 924 can modify data privacyelement 855 to generate artificial profile 800B, and can then modifydata privacy element 885 to generate artificial profile 800C. Dataprivacy elements 855 and 885 have been modified in accordance withorganization specific relationships such that artificial profiles 800Band 800C appear to be from the organization, while at the same timeobfuscating or blocking information about the true underlying individualemployee.

FIG. 10 illustrates an example embodiment of artificial profilesgenerated using deception techniques, according to certain aspects ofthe present disclosure. Most systems have known or unknownvulnerabilities and may be penetrated through a variety of means. Inorder to make it harder for an attacker to identify and/or exploit usersand user data within the system, system 1000 may generate artificialprofiles that are intended to mislead/misdirect an adversary, helping tomake the system asymmetrically more difficult to defeat.

In some embodiments, artificial profiles may be placed into theenvironment to be used for deception purposes instead of obfuscating aspecific end user. For example, some detection purposes can include, butis not limited to, honeypotting (data that appears to be legitimate, butis actually isolated and monitored to lure and detect attackers), movingtarget defense (modifying artificial profiles on a periodic, continuous,and/or dynamic basis to make it harder to identify actual patterns andvulnerabilities), white noise (adding more environments into the mix tomake it harder to identify actual user activity), and other similardeception techniques.

In some embodiments, System 1000 can include profile generation service1006 that can collect actual user and/or system data from the enterprisesystem 1002. Candidate profiles 1010 can be generated by profilegeneration service 1006 via AI and/or ML models, which generatesartificial data privacy elements and can aggregate them into a realisticprofile similar to the methodologies discussed in FIGS. 7-8C. Thecandidate profiles can be stored within candidate profiles database1008.

In some embodiments, one or more candidate profiles 1010 can be selectedas selected artificial profile A 1014A. Any number of candidate profile101 may be selected—for example, 50 candidate profiles 1010 may beselected to represent 50 fake users, and in some embodiments additionalcandidate profiles 1010/fake users may be selected when system 1000desires more fake users as white noise (either manually or dynamically).Artificial profile service 1012 may then insert selected artificialprofile A 1014A into a virtual environment isolated from the realnetwork.

For example, in some embodiments credentials service 1016 may seedselected artificial profile A 1014A with seemingly real credentials toget into the isolated virtual environment. The credentials fromcredentials service 1016 can be used for a number of different purposesincluding, but not limited to: providing an attacker something to“discover” (e.g., tricking an attacker into spending their time onartificial profile A 1014A instead of a real user); the ‘system’, suchas isolated containers or other systems that look like enterprise system1002, that the credentials provide access to can be monitored for use ofthese credentials (which is an indication that a system wascompromised/hacked and administrators can take action (or system 1000may take an automated action, such as moving target defense, etc.)); thecredentials can expose a broader fake network to the adversary, which isan artificially designed place that wastes their time, etc.

In some embodiments, the credentials can, for example, admit access toother systems or containers that look like enterprise system 1002. Insome embodiments, one or more selected artificial profile A's 1014A canbe associated with one another through the use of shared secrets (suchas passwords, usernames, access keys, access tokens, etc.), sharednetworking features (subnets, gateways, etc.), or other means. Thisprovides options for an attacker to attempt to exploit once they're ableto penetrate or otherwise access the system. This information willappear to relate to other user profiles or systems, increasing therealism of selected artificial profile A 1014A. This incentivizesattackers to focus on selected artificial profile A 1014A instead ofanother artificial profile masking a user online.

In some embodiments, selected artificial profile A 1014A and otherartificial profiles may be injected into the containers in a realisticway. For example, artificial profile service 1012 can include trafficgenerator service (for example, Selenium) that generates artificialtraffic within the isolated virtual environment (e.g., container). To anattacker, the artificial traffic would look real since traffic generatorservice could in some embodiments use features of traffic fromenterprise system 1002. Artificial profile service 1012 may also includecontent seeding service 1020, which can generate word files, text files,images, etc. that appear as if from a user associated with selectedartificial profile A 1014A. And in some embodiments, artificial profileservice 1012 may include presence seeding service 1022, which may lureattackers by creating social media accounts for each selected artificialprofile. These social media accounts would make the selected artificialprofiles appear to be from real people within theenterprise/organization. For example, presence seeding service 1022 maypost information that deceptively links the artificial user associatedwith the artificial profile to the enterprise (e.g., by posting they areemployees of enterprise, posting recent news about enterprise, etc.). Insome embodiments, additional logging and/or network monitoring can betargeted towards selected artificial profile A 1014A within the isolatedvirtual environment to detect an exploit. If an attacker is identified,since the attacker is within an isolated virtual environment and cannotaccess real data privacy elements, system 1000 can monitor theattacker's activities to determine how the attacker is attempting toexploit vulnerabilities in the system and the methods of malware/attackthey are employing. This information can in some embodiments be fed backinto system 1000 to refine and update existing security protocols.

In some embodiments, the fake users may be associated with artificialprofiles that also undergo moving target defense techniques. Forexample, a new artificial profile—for example, selected artificialprofile A′ 1014B—may be created from selected artificial profile A 1014Aby modifying one or more data privacy elements on a periodic orcontinuous basis similar to that disclosed for FIGS. 8C-9A. Similarly,selected artificial profile A″ 1014C may be created from selectedartificial profile A′ 1014B by modifying one or more data privacyelements, and selected artificial profile A′″ 1014D may be created fromselected artificial profile A″ 1014C by modifying one or more dataprivacy elements. Selected artificial profile A 1014A, selectedartificial profile A′ 1014B, selected artificial profile A″ 1014C,and/or selected artificial profile A′″ 1014D can modify data privacyelements via profile generation service 1006 via AI and/or ML models,which can generate artificial data privacy elements and can aggregatethem into a realistic profile similar to the methodologies discussed inFIGS. 7-8C. Therefore, new artificial profiles may be created from anartificial profile in the same or a similar way that an artificialprofile can be created from a real profile.

In some embodiments, selected artificial profile A 1014A, selectedartificial profile A′ 1014B, selected artificial profile A″ 1014C, andselected artificial profile A′″ 1014D can be rotated in use for movingtarget defense (e.g., user activity appears to move through theadditional selected artificial profiles instead of only selectedartificial profile A 1014A). In other embodiments, selected artificialprofile A′ 1014B, selected artificial profile A″ 1014C, and/or selectedartificial profile A′″ 1014D can be deployed in addition to selectedartificial profile A 1014A for deception purposes, including simulatedwhite noise purposes.

FIG. 11 is a diagram illustrating process flow 1100 for controllinginput signatures during an interaction session, according to certainaspects of the present disclosure. Process flow 1100 may be performed atleast in part at data protection platform 1150. Data protection platform1150 may be the same as or similar to data protection platform 510 ofFIG. 5, and thus, a description of data protection platform 1150 isomitted here. Process flow 1100 may be performed to modify inputsignatures associated with input received at a platform-secured browser,such as the platform-secured browser of FIG. 4. In some implementations,an input signature may include a feature that characterizes an inputreceived at the platform-secured browser. For example, a feature may bethe time signature of keystrokes inputted at the platform-securebrowser, however, the present disclosure is not limited thereto. Anotherexample of a feature that characterizes an input may be movementassociated with a cursor or mouse clicks.

The feature of an input can be exposed as a data privacy element when acomputing device accesses a website. To illustrate process 1100 and onlyas a non-limiting example, computer 1110 may be operated by a use. Forinstance, the user may be navigating a website or application using aplatform-secured browser. The website displayed on the browser ofcomputer 1110 may include input element 1120. Input element 1120 may bea text box displayed on a webpage for a search engine. Further, inputelement 1120 may be configured to receive input from the user operatingcomputer 1110. Continuing with the non-limiting example, the user maytype the phrase “interesting news” into input element 1120. The naturalkeystroke event timing associated with inputting the letters“interesting news” into input element 1120 is shown in keystroke timesignature 1130. For example, the user may naturally input the letters of“interesting news” in the following pattern: “IN,” then a pause,“TERES,” then a pause, “TING,” then a pause, “NEW,” then a pause, andfinally the letter “S.” The pauses of the pattern may occur naturally asthe user types the phrase. The user may move or adjust his or herfingers to continue typing. Naturally, certain letters are more likelyto be typed together quickly, such as “TING,” and for other letters,there may be a need for a brief pause while the user's fingers adjust orfind the next letter on a keyboard.

However, keystroke dynamics, such as a keystroke time signature can be adata privacy element that exposes information about the user operatingcomputer 1110. For example, an input profiling technique can be used todetermine that keystroke time signature 1130 indicates that the user isan English speaker. Letter grouping 1140 (i.e., the letters “TING”) areoften used in the English language, but are not often used together inother languages. Accordingly, the keystroke time signature 1130 can beevaluated to detect certain letter groupings, such as letter grouping1140 of “TING” typed sequentially without pauses. The detected lettergroups can reveal information about the user to a web server, such asthe language of the user.

According to certain embodiments, data protection platform 1150 canmodify keystroke time signature 1130 to obfuscate or block anyinformation that could be extracted from keystroke time signature 1130.For example, data protection platform 1150 can receive the input of“interesting news” from the platform-secured browser, however, dataprotection platform 1150 can detect keystroke time signature 1130 fromthe received input before transmitting the input to the web serverhosting the website that includes input element 1120. Instead oftransmitting the received input in the pattern of keystroke timesignature 1130, data protection platform 1150 can transmit the letters“interesting news” to the web server with the characteristic of modifiedkeystroke time signature 1160. Modified keystroke time signature 1160can indicate that all letters of “interesting news” are typedone-after-another without any pauses. Thus, while the network host, forexample, the web server hosting the website that includes input element1120, can gain access to the time signature or detect the time signatureof the received input of “interesting news,” but the detected timesignature at the web server would be modified keystroke time signature1160, instead of the real keystroke time signature of 1130.Advantageously, keystroke time signature 1130, which represents thenatural keystroke dynamics of the user operating computer 1110, can beobfuscated so as to prevent an accurate input profiling of the receivedtext.

In some implementations, data protection platform 1150 can automatically(or potentially not automatically) modify features of the receivedinput. For example, to modify the keystroke time signature of input textreceived at an input element, data protection platform 1150 can providean intermediary, such as an invisible overlay over the websites accessedby the platform-secured browser. In some implementations, theintermediary may intercept the input text received at the input element(e.g., before the text is transmitted to the web server), modify thetime signature of the input text, and then transmit the input text withthe modified time signature to the web server. Other techniques forperforming the modification may include modifying input streams,providing on-screen input methods, and other suitable techniques. Insome implementations, data protection platform 1150 may provideadditional information to the user, instead of modifying an inputstream. For example, data protection platform 1150 can notify the userthat the input text is defined by a keystroke time signature that mayreveal the language of the input text. In some implementations, the timesignature of the input text can be modified immediately (e.g., inreal-time) upon being received at the input element, whereas, in otherimplementations, the time signature of the input text can be modifiedover a period of time or at a later time. In some implementations, dataprotection platform 1150 can impose an effect on inputted text orinputted mouse interactions, such that the effect automatically changesthe browser to modify a time signature of the inputted text or mouseinteractions. For example, data protection platform 1150 can include ashim that serves as a wedge between the OS and the browser (orapplication, if being used). The shim can influence or modify how the OSreports inputs received at a keyboard or a mouse. The shim may be usedto modify how the OS reports the time signature of inputted text, forexample. In some implementations, an intermediary may not be used, butrather the native environment of the application or browser may bestructured so that inputs received at the browser are outputted with adefined time signature. In these implementations, the input text ormouse interaction is not intercepted at the browser, but rather, theinput text or mouse interaction is defined so as to have a particulartime signature. The present disclosure is not limited to detecting thekeystroke time signature of inputted text. In some implementations,mouse movement can also be detected as a data privacy element, andsubsequently modified by data protection platform 1150 to remove anyextractable characteristics.

It will be appreciated that the input may also include video signals,audio signals, motion signals, and/or haptic signals (e.g., receivedfrom a haptic glove). For example, in the context of a virtual-realityheadset, the inputs received at a web server may comprise much more datathan text or mouse interactions. Using the techniques described above,data protection platform 1150 can modify the inputted video signals,audio signals, motion signals, and/or haptic signals, so as to obfuscateinformation about the user operating the virtual-reality headset.

The foregoing description of the embodiments, including illustratedembodiments, has been presented only for the purpose of illustration anddescription and is not intended to be exhaustive or limiting to theprecise forms disclosed. Numerous modifications, adaptations, and usesthereof will be apparent to those skilled in the art.

What is claimed is:
 1. A computer-implemented method, comprising:identifying, at a platform-secured network element between a computingdevice and a gateway device, a set of data privacy elements, wherein adata privacy element characterizes a feature of a computing device, andwherein a data privacy element is detectable by a network host; trainingan artificial profile model using a data set of data privacy elements,wherein the artificial profile model is trained to define a relationshipthat is associated with one or more constraints between the set of dataprivacy elements; generating a first artificial profile, wherein thefirst artificial profile includes the set of data privacy elements, bymodifying a first data privacy element based on the artificial profilemodel; subsequent to generating the first artificial profile,periodically modifying a second data privacy element to generate asecond artificial profile, wherein the second data privacy element ismodified in accordance with a constraint associated with therelationship defined by the artificial profile model; receiving a signalindicating that a computing device is requesting access to a networklocation; and masking the computer device from being identified by thenetwork host by sending the second artificial profile including thesecond data privacy element to the network location.
 2. Thecomputer-implemented method of claim 1, wherein the second data privacyelement is dynamically modified based on a trigger event, wherein thetrigger event is based on a detection of a malware signature.
 3. Thecomputer-implemented method of claim 2, wherein the trigger event isbased on one or more parameters comprising suspicious API calling,suspicious instruction execution, or suspicious accessing of a certainIP address.
 4. The computer-implemented method of claim 1, wherein thesecond data privacy element is modified after a period of time inaccordance with the constraint included in the artificial profile model,and wherein the constraint represents a dependency between two or moredata privacy elements of the set of data privacy elements.
 5. Thecomputer-implemented method of claim 1, the method further comprising:identifying the set of data privacy elements based on an organizationspecific feature of a computer device within the organization; andmodifying the first data privacy element and the second data privacyelement based on the relationship, wherein the relationship is based onthe organization specific feature and is associated with one or moreconstraints between the set of data privacy elements.
 6. Thecomputer-implemented method of claim 1, wherein the second data privacyelement is modified in accordance with the constraint to create aspecific number of artificial profiles.
 7. The computer-implementedmethod of claim 1, wherein the second artificial profile is insertedinto an isolated virtual environment that monitors for malware activity.8. A system, comprising: one or more data processors; and anon-transitory computer-readable storage medium containing instructionswhich, when executed on the one or more data processors, cause the oneor more data processors to perform operations including: identifying, ata platform-secured network element between a computing device and agateway device, a set of data privacy elements, wherein a data privacyelement characterizes a feature of a computing device, and wherein adata privacy element is detectable by a network host; training anartificial profile model using a data set of data privacy elements,wherein the artificial profile model is trained to define a relationshipthat is associated with one or more constraints between the set of dataprivacy elements; generating a first artificial profile, wherein thefirst artificial profile includes the set of data privacy elements, bymodifying a first data privacy element based on the artificial profilemodel; subsequent to generating the first artificial profile,periodically modifying a second data privacy element to generate asecond artificial profile, wherein the second data privacy element ismodified in accordance with a constraint associated with therelationship defined by the artificial profile model; receiving a signalindicating that a computing device is requesting access to a networklocation; and masking the computer device from being identified by thenetwork host by sending the second artificial profile including thesecond data privacy element to the network location.
 9. The system ofclaim 8, wherein the second data privacy element is dynamically modifiedbased on a trigger event, wherein the trigger event is based on adetection of a malware signature.
 10. The system of claim 9, wherein thetrigger event is based on one or more parameters comprising suspiciousAPI calling, suspicious instruction execution, or suspicious accessingof a certain IP address.
 11. The system of claim 8, wherein the seconddata privacy element is modified after a period of time in accordancewith the constraint included in the artificial profile model, andwherein the constraint represents a dependency between two or more dataprivacy elements of the set of data privacy elements.
 12. The system ofclaim 8, wherein the operations further comprise: identifying the set ofdata privacy elements based on an organization specific feature of acomputer device within the organization; and modifying the first dataprivacy element and the second data privacy element based on therelationship, wherein the relationship is based on the organizationspecific feature and is associated with one or more constraints betweenthe set of data privacy elements.
 13. The system of claim 8, wherein thesecond data privacy element is modified in accordance with theconstraint to create a specific number of artificial profiles.
 14. Thesystem of claim 8, wherein the second artificial profile is insertedinto an isolated virtual environment that monitors for malware activity.15. A computer-program product tangibly embodied in a non-transitorymachine-readable storage medium, including instructions configured tocause a data processing apparatus to perform operations including:identifying, at a platform-secured network element between a computingdevice and a gateway device, a set of data privacy elements, wherein adata privacy element characterizes a feature of a computing device, andwherein a data privacy element is detectable by a network host; trainingan artificial profile model using a data set of data privacy elements,wherein the artificial profile model is trained to define a relationshipthat is associated with one or more constraints between the set of dataprivacy elements; generating a first artificial profile, wherein thefirst artificial profile includes the set of data privacy elements, bymodifying a first data privacy element based on the artificial profilemodel; subsequent to generating the first artificial profile,periodically modifying a second data privacy element to generate asecond artificial profile, wherein the second data privacy element ismodified in accordance with a constraint associated with therelationship defined by the artificial profile model; receiving a signalindicating that a computing device is requesting access to a networklocation; and masking the computer device from being identified by thenetwork host by sending the second artificial profile including thesecond data privacy element to the network location.
 16. Thecomputer-program product of claim 15, wherein the second data privacyelement is dynamically modified based on a trigger event, wherein thetrigger event is based on a detection of a malware signature.
 17. Thecomputer-program product of claim 15, wherein the second data privacyelement is modified after a period of time in accordance with theconstraint included in the artificial profile model, and wherein theconstraint represents a dependency between two or more data privacyelements of the set of data privacy elements.
 18. The computer-programproduct of claim 15, wherein the operations further comprise:identifying the set of data privacy elements based on an organizationspecific feature of a computer device within the organization; andmodifying the first data privacy element and the second data privacyelement based on the relationship, wherein the relationship is based onthe organization specific feature and is associated with one or moreconstraints between the set of data privacy elements.
 19. Thecomputer-program product of claim 15, wherein the second data privacyelement is modified in accordance with the constraint to create aspecific number of artificial profiles.
 20. The computer-program productof claim 15, wherein the second artificial profile is inserted into anisolated virtual environment that monitors for malware activity.
 21. Thecomputer-program product of claim of claim 16, wherein the trigger eventis based on one or more parameters comprising suspicious API calling,suspicious instruction execution, or suspicious accessing of a certainIP address.